I just got WP running on my own server. I am not trying to lock things down more. What permissions should the db user have to my WP db?

5 Answers 5


If you did want to lock things down.... a normal wordpress site will usually only require the database user to have SELECT, INSERT, UPDATE and DELETE.

If you want to use the automatic update feature it will also require CREATE and ALTER.

Some plugins may require other permissions but most won't.


WordPress only uses one DB user for everything, and he'll need to have all permissions to the database. CREATE and ALTER are used when upgrading, sometimes. INSERT, UPDATE, and SELECT are used all the time.


I've asked a similar but a bit more detailed question lately: MySQL Database User: Which Privileges are needed?

The short installation instruction for WordPress ("5 Minutes") state that:

Create a database for WordPress on your web server, as well as a MySQL user who has all privileges for accessing and modifying it.

This is the minimum of privileges / permissions that are needed and next to those, others are not needed.

So if your user has more privileges than those, you can reduce them.


For a secure database, selecting ALL PRIVILEGES is definitely NOT the answer.

See the Codex: http://codex.wordpress.org/Hardening_WordPress

> 10 Database Security
>     10.1 Restricting Database User Privileges
  • This is a bad advice, many plugins assume they can create tables and will just fail if they can't. Core itself might need to introduce new table or alter existing ones. Mar 30, 2016 at 9:42
  • 1
    As the codex explains, you have to know what you are doing and what is your purpose for doing it. Example 1: NO SECURITY If you want everything to work but do not care about security, then just enable everything and take your chances. Example 2: FULL SECURITY If you care about security, then read the codex article. When upgrading anything, you will need to REMEMBER to enable whatever privileges are required by the plugin or Wordpress upgrade.
    – Jerry-L
    Mar 30, 2016 at 19:02
  • Mark Kaplun is correct... The original poster's (op) question does in fact say he is "not trying to lock things down." So assigning ALL privileges to your database will allow any and all Wordpress upgrades to work - that's the good advice for him (the op). By the way, here's an article that shows CATEGORIES for permissions (Data, Structure, Admin), wpwhitesecurity.com/wordpress-security-hacks/….
    – Jerry-L
    Mar 30, 2016 at 19:19
  • The only proper way to secure a WP DB is to have one per site, then you have one "root" user and you do not care much about permissions. But that is not what the OP asked. As for the article you point to... it is funny to discuss security when you have phpmyadmin installed and open to the web. What is the point of restricting the wordpress user when you have another that is not restricted (ok, there is a point, but still sloppy IMO). Mar 30, 2016 at 19:33

The answer is all privileges. This is taken straight from the wordpress install page here Look at the phpMyAdmin section and it states "Click Check All to select all privileges.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.